Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

hCaptcha now runs on fifteen percent of the internet

hcaptcha.com

Post reply on HN
Print view View original

121–130 of 380 posts

Re: hCaptcha now runs on fifteen percent of the internet

#121

Post by fab1an »

modzu wrote: post #101
blindm wrote: post #11

I think it's great. So many sites sit behind Cloudflare now and Cloudflare now uses hCaptcha, which is a big win. And the hCaptchas themselves are easy to complete. No more wondering if you actually clicked on 'all' the traffic lights anymore, yay! I inspected the source code of Google's reCaptcha offering and was disgusted at how many bits of information they were collecting. They also seem to be fingerprinting user…

well the slight improvement in usability is a win, but is it really any more anonymous than recaptcha?

Unlike Google, which is making hundreds of billions with ads, we have zero reasons to track users - customers pay us to stop bots, and that's the product we provide.

Re: hCaptcha now runs on fifteen percent of the internet

#122

Post by pkaye »

xapata wrote: post #53

hCaptcha makes money by having humans label things to teach machines. This suggests that at some point, the machines will be nearly as good as the humans at labeling. At this point, until the humans are tasked with a different training exercise, a bot will be effectively indistinguishable from a human via hCaptcha. If there's value in it, it sounds like a spammer could train an hCaptcha-defeating bot via hCaptcha.

This is how Skynet starts.

Re: hCaptcha now runs on fifteen percent of the internet

#123

Post by thewebcount »

accounted wrote: post #106

I don't understand why anyone likes hCaptcha. With reCaptcha, I rarely got more than the checkbox. Now I get a series of puzzles every time I want to look at a web page. When that happens, I'm just closing out, and going to a better website.

Because many of us get the same puzzles over and over with reCaptcha, and often get sent into the infinite puzzles zone despite being both a human and answering correctly. The assumptions built in to reCaptcha just aren't good. There are people that don't accept cookies for anything, but who aren't bots. There are real humans using text-only browsers. There are people who's mouse and keyboard events fall far outside the expected range of normal human users, or who use aids such as macro keys that playback canned responses and confuse Google's methods. So I can definitely imagine anyone who's dealt with that shit for years being happy to have something different to try. Even if it's just as annoying, at least it's not the same damn thing!

Re: hCaptcha now runs on fifteen percent of the internet

#125

Post by xur17 »

fab1an wrote: post #113
Zak wrote: post #48

I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…

With our hCaptcha Enterprise product ( https://www.botstop.com ), showing a CAPTCHA actually only happens in rare cases (relatively speaking..) - vast majority of bots are caught and stopped in the background (using ML), and most users will never see one.

I'm curious what how rare it is / what triggers it. In my experience, at least Google triggers hard mode if you use any sort of privacy preserving technology, etc ublock, brave, etc. It's very frustrating.

Re: hCaptcha now runs on fifteen percent of the internet

#126

Post by slx26 »

Zak wrote: post #48

I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…

> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time

As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way to not invade users privacy and not waste their time, unless you are manually filtering / moderating all the input data, in which case you can't really say it scales. You might say emails can solve the problem. Well, they don't really solve the problem against dedicated attackers / spammers, and they do invade privacy for the average user. You can use statistical approaches to try to reduce privacy invasion or others, but I don't know of anything that really solves the problem without manual identity verification at some point.

Re: hCaptcha now runs on fifteen percent of the internet

#127

Post by jsnell »

renewiltord wrote: post #115
jsnell wrote: post #76

Earlier quoted context omitted.

There's a good reason for what you're identifying as misuse. If you show a captcha after a failed password, you need to show a one after a correct password as well. Otherwise you leak information. You can have other solutions, e.g. in a login flow that splits the username and password entry, it's advantageous to put the captcha between those two steps. But even in those solutions the display of the captcha must be in…

> If you show a captcha after a failed password, you need to show a one after a correct password as well. Otherwise you leak information. Presumably, if the person has entered the right username and password they're going to get access to the service at which point they'll know they entered the right one. What information exactly is leaked here?

The reason you'd want a captcha on a login page is to protect against brute-forcing of some sort. For example credential stuffing or a dictionary attack.

The information the attacker is looking for is the validity of the password. If you want to use a captcha to protect against this, the outcome must be the same whether the password is valid or not. Because if you only show the captcha for failed logins, the attacker can find out that the password was incorrect without solving a captctha, which by symmetry means they can also find out if it's correct without solving one.

Re: hCaptcha now runs on fifteen percent of the internet

#128

Post by accounted »

thewebcount wrote: post #123
accounted wrote: post #106

I don't understand why anyone likes hCaptcha. With reCaptcha, I rarely got more than the checkbox. Now I get a series of puzzles every time I want to look at a web page. When that happens, I'm just closing out, and going to a better website.

Because many of us get the same puzzles over and over with reCaptcha, and often get sent into the infinite puzzles zone despite being both a human and answering correctly. The assumptions built in to reCaptcha just aren't good. There are people that don't accept cookies for anything, but who aren't bots. There are real humans using text-only browsers. There are people who's mouse and keyboard events fall far outside…

I would say it's not just as annoying, it's worse. It has all the same annoyances, except now I get the worst outcome every time.

Re: hCaptcha now runs on fifteen percent of the internet

#129

Post by meibo »

alexnewman wrote: post #2

Curious what people think about hCaptcha?

I really don't like it. They are generally harder and if I visit a CF site multiple times, I have to solve them multiple times. Even if this is up to the customer, it's annoying and should be discouraged.

I didn't mind solving a reCaptcha once, I mind forcing myself through these every 10 minutes.

Re: hCaptcha now runs on fifteen percent of the internet

#130

Post by thewebcount »

surround wrote: post #79

Almost all of the users that Cloudflare shows captchas to are Tor users. Is there any reason why this couldn’t be done without Javascript?

I don't believe this to be true. I've never touched Tor, and am constantly hounded by different Captcha mechanisms. I do aggressively block tracking, though.
Post reply on HN